6299 matches found
MGASA-2024-0355 Updated openssl packages fix security vulnerability
Low-level invalid GF2^m parameters lead to OOB memory accesses. CVE-2024-9143...
MGASA-2024-0330 Updated quictls packages fix security vulnerabilities
The updated packages fix security vulnerabilities...
MGASA-2024-0324 Updated cjson packages fix security vulnerability
cJSON was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSONSetValuestring at cJSON.c. CVE-2024-31755...
MGASA-2024-0223 Updated nano packages fix security vulnerability
A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privilege...
MGASA-2024-0217 Updated golang packages fix security vulnerabilities
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects...
MGASA-2024-0197 Updated qtnetworkauth5 & qtnetworkauth6 packages fix security vulnerability
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values...
MGASA-2024-0185 Updated python-sqlparse packages fix security vulnerability
Passing a heavily nested list to sqlparse.parse leads to a Denial of Service due to RecursionError...
MGASA-2024-0165 Updated freeglut packages fix security vulnerabilities
freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function. CVE-2024-24258 freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function. CVE-2024-24259...
MGASA-2024-0163 Updated libvirt packages fix security vulnerability
A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of...
MGASA-2024-0152 Updated opencryptoki packages fix security vulnerability
A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key. CVE-2024-0914...
MGASA-2024-0153 Updated firefox packages fix security vulnerabilities
CVE-2024-3852: GetBoundName in the JIT returned the wrong object CVE-2024-3854: Out-of-bounds-read after mis-optimized switch statement CVE-2024-3857: Incorrect JITting of arguments led to use-after-free during garbage collection CVE-2024-2609: Permission prompt input delay could expire when not ...
MGASA-2024-0051 Updated c-ares packages fix security vulnerabilities
The updated packages fix a security vulnerability: Out of bounds read in aresreadline. CVE-2024-25629...
MGASA-2024-0029 Updated postfix packages fix a security vulnerability
Postfix has been updated to fix smtp smuggling, an email spoofing attack that involves a composition of email services with specific differences in the way they handle line endings other than...
MGASA-2024-0030 Updated pam packages fix a security vulnerability
The updated packages fix a security vulnerability: pamnamespace: protectdir: use ODIRECTORY to prevent local DoS situations. CVE-2024-22365...
MGASA-2023-0343 Updated thunderbird packages fix security vulnerabilities
The updated packages fix security vulnerabilities. Out-of-bound memory access in WebGL2 blitFramebuffer. CVE-2023-6204 Use-after-free in MessagePort::Entangled. CVE-2023-6205 Clickjacking permission prompts using the fullscreen transition. CVE-2023-6206 Use-after-free in...
MGASA-2023-0312 Updated zlib packages fix a security vulnerability
The updated packages fix a security vulnerability: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. CVE-2023-45853...
MGASA-2023-0302 Updated python-nltk package fixes a security vulnerability
python-nltk 3.6.6 update resolves ReDoS opportunity by fixing incorrectly specified regex...
MGASA-2023-0286 Updated glibc packages fix a security vulnerability
The updated packages fix a security vulnerability: A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBCTUNABLES environment variables when...
MGASA-2023-0269 Updated vim packages fix security vulnerability
Use After Free in GitHub repository vim/vim prior to 9.0.1840. CVE-2023-4733 Use After Free in GitHub repository vim/vim prior to 9.0.1857. CVE-2023-4750 Use After Free in GitHub repository vim/vim prior to 9.0.1858. CVE-2023-4752...
MGASA-2023-0252 Updated openldap packages fix security vulnerability
Null pointer dereference in bermemallocx function CVE-2023-2953...
MGASA-2023-0236 Updated mingw-nsis packages fix security vulnerability
Mishandles access control for an uninstaller directory. CVE-2023-37378...
MGASA-2023-0216 Updated apache-ivy packages fix security vulnerability
Improper path allowed when extracting archive.CVE-2022-37865 Possible path traversal in download path CVE-2022-37866...
MGASA-2023-0180 Updated dmidecode packages fix security vulnerability
Dmidecode allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. CVE-2023-30630...
MGASA-2023-0173 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.110 and fixes atleast the following security issues: A slab-out-of-bound read problem was found in brcmfgetassocies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c. This issue could occur when associnfo-reqlen data is bigger than t...
MGASA-2023-0171 Updated firefox/nss/rootcerts packages fix security vulnerability
In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks CVE-2023-32205. An out-of-bounds read could have led to a crash in the RLBox Expat driver CVE-2023-32206. A missing delay in popup...
MGASA-2023-0148 Updated kernel packages fix security vulnerability
This kernel update is based on upstream 5.15.106 and fixes atleast the following security issues: A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap...
MGASA-2023-0144 Updated libheif packages fix security vulnerability
Vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call. CVE-2023-0996...
MGASA-2023-0139 Updated ceph packages fix security vulnerability
Openstack manilla owning a Ceph File system "share", enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system...
MGASA-2023-0095 Updated mysql-connector-c++ packages fix security vulnerability
The program plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. CVE-2022-24407...
MGASA-2022-0465 Updated matio packages fix security vulnerability
matio aka MAT File I/O Library 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble called from ReadInt32Data and MatVarRead4. CVE-2020-36428 matio aka MAT File I/O Library 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MMmemcpy called from H5MMmalloc and...
MGASA-2022-0438 Updated libx11 packages fix security vulnerability
Memory leak in XRegisterIMInstantiateCallback. CVE-2022-3554 Memory leak in XFreeX11XCBStructure. CVE-2022-3555...
MGASA-2022-0425 Updated binutils/gdb packages fix security vulnerability
libiberty: Heap/stack buffer overflow in the dlanglname function in d-demangle.c CVE-2021-3826 binutils: heap-based buffer overflow in bfdgetl32 when called by stripmain in objcopy.c via a crafted file CVE-2022-38533...
MGASA-2022-0401 Updated virglrenderer packages fix security vulnerability
An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer virglrenderer. This flaw allows a malicious guest to create a specially crafted virgil resource and then issue a VIRTGPUEXECBUFFER ioctl, leading to a denial of service or possible code execution. CVE-2022-0135 A flaw was...
MGASA-2022-0394 Updated krb5-appl packages fix security vulnerability
NULL pointer dereference in krb5-appl telnetd. CVE-2022-39028...
MGASA-2022-0363 Updated libvncserver packages fix security vulnerability
libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup. CVE-2020-29260...
MGASA-2022-0352 Updated expat packages fix security vulnerability
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. CVE-2022-40674...
MGASA-2022-0348 Updated firejail packages fix security vulnerability
root escalation in --join logic CVE-2022-31214...
MGASA-2022-0340 Updated google-gson packages fix security vulnerability
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes, which may lead to DoS attacks. CVE-2022-25647...
MGASA-2022-0339 Updated redis packages fix security vulnerability
Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...
MGASA-2022-0306 Updated canna packages fix security vulnerability
Move UNIX socket dir from /tmp to /run to avoid local attackers being able to place bogus directories in its stead. CVE-2022-21950...
MGASA-2022-0288 Updated libitrpc packages fix security vulnerability
It was discovered that libtirpc incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service CVE-2021-46828...
MGASA-2022-0292 Updated teeworlds packages fix security vulnerability
Code execution via malicious map file CVE-2021-43518...
MGASA-2022-0280 Updated ruby-sinatra packages fix security vulnerability
Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970...
MGASA-2022-0269 Updated gdk-pixbuf2.0 packages fix security vulnerability
It was discovered that gdk-pixbuf contained a buffer overwrite in io-gif-animation.c compositeframe exploitable using a crafted GIF CVE-2021-46829...
MGASA-2022-0267 Updated libtiff packages fix security vulnerability
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. CVE-2022-2056, CVE-2022-2057, CVE-2022-2058...
MGASA-2022-0265 Updated virtualbox packages fix security vulnerabilities
This update provides the upstream 6.1.36 maintenance release that fixes at least the following security vulnerabilities: A vulnerability in the Oracle VM VirtualBox prior to 6.1.36 contains an easily exploitable vulnerability that allows a high privileged attacker with logon to the infrastructure...
MGASA-2022-0264 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.55 and fixes at least the following security issues: There are use-after-free vulnerabilities caused by timer handler in net/rose/rosetimer.c of linux that allow attackers to crash linux kernel without any privileges CVE-2022-2318. Xen Block and...
MGASA-2022-0250 Updated curl packages fix security vulnerability
Set-Cookie denial of service. CVE-2022-32205 HTTP compression denial of service. CVE-2022-32206 Unpreserved file permissions. CVE-2022-32207 FTP-KRB bad message verification. CVE-2022-32208...
MGASA-2022-0247 Updated cyrus-imapd packages fix security vulnerability
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service multiple-minute daemon hang via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. CVE-2021-33582...
MGASA-2022-0159 Updated curl packages fix security vulnerability
OAUTH2 bearer bypass in connection re-use. CVE-2022-22576 Credential leak on redirect. CVE-2022-27774 Bad local IPv6 connection reuse. CVE-2022-27775 Auth/cookie leak on redirect. CVE-2022-27776...